Istio RBAC install failed on RBAC cluster

[istio]

Istio RBAC install failed on RBAC cluster

[saturnism]

Had to use admin user w/ client cert to fetch the credential, then the errors went a way :/

CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud container clusters get-credentials ...

[saturnism]

This needs to be re-opened. It seems like we may have lost it from the doc. Need to add admin user explicitly to the role binding:

kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin [email protected]

[costinm]

Yes, I think this is working as intended, granting permissions requires admin user. We may need to document it better ( or k8s RBAC docs should make it more obvious ).

[yiakwy]

@saturnism I encountered the same problem but I don't understand

CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud container clusters get-credentials

It is a not command. What are you talking about?

[andraxylia]

This is a gcloud command if you use GKE (Google Container Engine).

There have been many changes in RBAC since then, and it was fixed in the master. I suggest to take the latest istio-rbac-beta.yaml file from the master branch.

[yiakwy]

@andraxylia I am sure that

CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True gcloud container clusters get-credentials

Is NOT a valid gcloud command even you set

CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True

in a .bashprofile. the syntax is

"gcloud container clusters get-credentials" + some service name.

It was not clear.

[yiakwy]

Perhaps you might as well set

gcloud beta container clusters get-credentials
instead after set CLOUDSDK_CONTAINER_USE_CLIENT_CERTIFICATE=True.

[ZackButcher]

Looks like this crept back with our 0.2 docs, we need to go restore this bit of info.

[ldemailly]

This is fixed in istio/istio.io#569
mentioned in https://istio.io/docs/setup/kubernetes/quick-start.html#prerequisites